Hey guys, [customer] logs are getting validation errors specifically with their "Group Creation" events, where their logs are missing the group.id attribute. Who should I work with to get the parser updated on Google's side to accommodate this use case? [Customer] wants to see the updates for this parser come through, so they're not looking to push a customer specific version of it.
Chronicle Parser - SentinelOne_CF
+16Support would be the best place to start. You would want to share with them some specific examples. Open a ticket with them and they should be able to get you where you need to be.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.